2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): User groups; username='mkhan', groups='['no_root', 'all']'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.auth(3): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): User authentication successful; entity='mkhan', domain='', auth_info='gw-auth'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: rdp.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Inband data parsed; field='username', replacement_value='PAM-malmuhareb@ads.cchi.gov.sa', server_port='3389', server_host='10.1.92.190'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: rdp.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Looked up user data and removed redirection cookie; redirection_id='d3f0e9a3-9c44-4571-8912-d8e2dc49a3ed', domain='', user='PAM-malmuhareb@ads.cchi.gov.sa%(10.1.92.190)^3389'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.session(3): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410): Server connection established; server_fd='401', server_address='AF_INET(10.1.92.190:3389)', server_hostname='fees-maintenanc.ads.cchi.gov.sa', server_zone='Zone(internet)', server_local='AF_INET(10.1.106.172:46880)', server_protocol='TCP'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: rdp.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Disabling server-side support for redirected authentication mode;
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: rdp.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Security protocol selected successfully; client_protocols='tls,nla(hybrid),nla(hybrid_ex)', forwarded_protocols='tls,nla(hybrid),nla(hybrid_ex)', selected_protocol='nla(hybrid_ex)'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: rdp.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Starting SSL layer;
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): TLS alert received; operation='write', alert_type='fatal', alert_reason='decode error'
2022-08-22T09:31:48+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.error(1): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): SSL handshake failed; side='server', error='error:1408F10B:SSL routines:lib(20):ssl3_get_record:func(143):wrong version number:reason(267), supressed 1 messages'
2022-08-22T09:31:55+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.audit(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1407/rdp): Closing connection; connection='safeguard_rdp', protocol='rdp', connection_id='97d68fa5-3a11-4686-a0dd-395b075f382d', client_ip='10.1.96.26', client_hostname='', client_port='49901', server_ip='', server_hostname='', server_port='', gateway_username='', remote_username='', verdict='ZV_REJECT', network_id=''
2022-08-22T09:31:55+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1407/rdp): Plugin call log follows; plugin_location='/opt/scb/var/plugins/aa/SGAA/main.py'
2022-08-22T09:31:55+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1407/rdp): Plugin(aa/SGAA/main.py): Logging initialized to level=info
2022-08-22T09:31:55+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.session(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1407): Ending proxy instance;
2022-08-22T09:31:58+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.audit(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1408/rdp): Closing connection; connection='safeguard_rdp', protocol='rdp', connection_id='97d68fa5-3a11-4686-a0dd-395b075f382d', client_ip='10.1.96.26', client_hostname='', client_port='49905', server_ip='10.1.92.190', server_hostname='fees-maintenanc.ads.cchi.gov.sa', server_port='3389', gateway_username='mkhan', remote_username='', verdict='ZV_REJECT', network_id=''
2022-08-22T09:31:58+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.session(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1408): Ending proxy instance;
2022-08-22T09:31:58+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.audit(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1409/rdp): Closing connection; connection='safeguard_rdp', protocol='rdp', connection_id='97d68fa5-3a11-4686-a0dd-395b075f382d', client_ip='10.1.96.26', client_hostname='', client_port='49906', server_ip='10.1.92.190', server_hostname='fees-maintenanc.ads.cchi.gov.sa', server_port='3389', gateway_username='mkhan', remote_username='', verdict='ZV_REJECT', network_id=''
2022-08-22T09:31:58+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.session(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1409): Ending proxy instance;
2022-08-22T09:31:58+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.audit(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Closing connection; connection='safeguard_rdp', protocol='rdp', connection_id='97d68fa5-3a11-4686-a0dd-395b075f382d', client_ip='10.1.96.26', client_hostname='', client_port='49909', server_ip='10.1.92.190', server_hostname='fees-maintenanc.ads.cchi.gov.sa', server_port='3389', gateway_username='mkhan', remote_username='', verdict='ZV_REJECT', network_id=''
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin call log follows; plugin_location='/opt/scb/var/plugins/aa/SGAA/main.py'
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(aa/SGAA/main.py): Logging initialized to level=info
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(aa/SGAA/main.py): Close authentication
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(aa/SGAA/main.py): DELETE request; url=https://10.1.106.173:8649/service/SPSInteractive/v3/Plugin/Authentication, parameters={'sessionId': 'svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1408', 'token': '4vMATSughPQ1ZSznwaicknpKijJk68VyUgVqL3wun9YY6xfwTrojzU6Advq'}, auth=PsmPlugin
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(aa/SGAA/main.py): Response to DELETE; data=
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin call log follows; plugin_location='/opt/scb/var/plugins/credentialstore/SGCredStore/main.py'
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(credentialstore/SGCredStore/main.py): Logging initialized to level=info
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(credentialstore/SGCredStore/main.py): Executing check-in as it was postponed in authentication_completed account=PAM-malmuhareb asset=fees-maintenanc.ads.cchi.gov.sa
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(credentialstore/SGCredStore/main.py): Notify SPP about session ended
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(credentialstore/SGCredStore/main.py): DELETE request; url=https://10.1.106.173:8649/service/SPSInteractive/v3/Plugin/Credentials, parameters={'sessionId': 'svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1408'}, auth=PsmPlugin
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: scb.info(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410/rdp): Plugin(credentialstore/SGCredStore/main.py): Response to DELETE; data=
2022-08-22T09:31:59+03:00 hqsps01.ads.cchi.gov.sa zorp/scb_rdp[2085]: core.session(4): (svc/uw2n8oD5f34FVmr8RKaVLJ/safeguard_rdp:1410): Ending proxy instance;
